License behavior for virtual appliances and subscription services

Products

• ProxySG Software - SGOS
• Intelligence Services
• Management Center
• Reporter
• Reporter-VA
• SGVA
• Content Analysis Software

Issue/Introduction

You want to know how virtual appliances behave under these conditions:

• Duplicate Serial: Reuse of serials for multiple deployments
• License server Communication Status: Communication to Broadcom licensing validation servers is impaired (e.g. validation.es.bluecoat.com)
• License expiry: License has lapsed

The following error messages may be observed due to a licensing issue:

• License suspension by duplicate serial in XX days
• License suspended by duplicate serial
• License suspension by server avoidance in XX days
• License suspended by server avoidance
• Health Monitor (CRITICAL): SGOS Base License Expiration below 0 days left
• Device is not entitled to download categorization database
• Content Filter Communication Status: Categorization has XX update errors
• Critical device health status

Resolution

Use Case / Product Version	Condition	ProxySG/SG-VA	Content Analysis	Management Center	Reporter
Duplicate Serial Detection	Grace Period	30 days	30 days	30 days	30 days
	Action after grace period has passed	License suspendedsee behaviour of license expiry below	License invalidated	License suspended	license suspended
License Server Communication Status	Grace Period	7 days	7 days	7 days	12 hours
	Action after grace period has passed	License suspendedsee behaviour of license expiry below	License invalidated	license suspended	New DB and LogSource function prohibited;new data processing halts
License Expiry	Grace Period	none	none	15 days	none
	Action after license expiry or after grace period has passed	license_expired exception page will be served to requests.Traffic will be denied in most cases (see details in admin guide for details)	Base license will show as expired and license_error ICAP exception error will be returned	Unable to load web console	New DB and LogSource function prohibited;new data processing halts
Documentation & Details		SG-VA ICGSG Admin Guide (see page 62)	CA WebGuide	MC WebGuide	RP WebGuide

• Q: What happens in case of Intelligence Services expiration?
• A: See: BCIS (Intelligence Services) Licensing Expiry FAQ for Edge SWG (ProxySG)
  
  
• Q: What happens to the following features if the IS subscription expires?
• A: Web Filter database update: After the expiration, the Web Filter database will no longer be updated. The update of the database will keep on failing until a new subscription date is applied. ProxySG logs 401 authentication error
  
  Web Pulse communication: WebPulse communication is no longer available after the subscription expires. ProxySG will not access to WebPulse service for dynamic URL categorization, the ProxySG WebPulse Health Check will also fail.
  Web Filter database validity: Web Filter database has 'Data Valid until' timestamp. The ProxySG will keep using the latest downloaded database until that date. After that, ProxySG will categorize all the web sites as 'unavailable'. 
  
  
• Q: What happens in case of File Inspection Services expiration on Content Analysis / ASG?
• A: There is no grace period on FI subscriptions. When it expires no content scanning will occur.
  See: Does Content Analysis send an Alert When the Base License or Other Component Expires?